Intermediate REST API Development and Testing

Learn to enhance your REST API with dynamic parameters, authentication, error handling, logging, and professional documentation. This hands-on guide builds on basic API concepts to create production-ready services.

You’ve already built and tested a basic API in the beginner section. Now, it’s time to enhance it with features that make it production-ready and professionally robust.

Building on Your Foundation

In this intermediate guide, you'll enhance your basic API with real-world features that professional APIs require. These enhancements will make your API more flexible, secure, and maintainable—exactly what production applications need.

What You’ll Implement in This Guide

By the end of this intermediate tutorial, you’ll have added these critical API features:

Dynamic parameters for flexible data retrieval
Authentication to secure your API endpoints
Validation to ensure data integrity
Error handling for graceful failure responses
Logging for monitoring and debugging
Professional documentation with organized Swagger specs

Let’s transform your basic API into a professional-grade service!

Enhancing Your API with Dynamic Parameters

Most real-world APIs need to filter and search data. Let’s add these capabilities to your API.

Step 1: Query Parameters and Path Variables

Let’s modify your API to support both retrieving all users and finding specific users:

Feature	Implementation	Example
Path Parameters	Get specific resources by ID	`GET /users/1`
Query Parameters	Filter collections	`GET /users?name=alice`

Update your app.py file with these enhanced endpoints:

from flask import Flask, request, jsonify
from flasgger import Swagger

app = Flask(__name__)
Swagger(app)

# Sample data - in a real app, this would come from a database
users = [
    {"id": 1, "name": "Alice", "email": "alice@example.com"},
    {"id": 2, "name": "Bob", "email": "bob@example.com"}
]

@app.route('/users', methods=['GET'])
def get_users():
    """
    Get all users or filter by name
    ---
    parameters:
      - name: name
        in: query
        type: string
        required: false
        description: Filter users by name (case-insensitive)
    responses:
      200:
        description: A list of users
    """
    name_filter = request.args.get('name')
    if name_filter:
        filtered_users = [u for u in users if name_filter.lower() in u["name"].lower()]
        return jsonify(filtered_users)
    return jsonify(users)

@app.route('/users/<int:user_id>', methods=['GET'])
def get_user(user_id):
    """
    Get a user by ID
    ---
    parameters:
      - name: user_id
        in: path
        type: integer
        required: true
        description: The ID of the user to retrieve
    responses:
      200:
        description: A single user object
      404:
        description: User not found
    """
    user = next((u for u in users if u["id"] == user_id), None)
    if user:
        return jsonify(user)
    return jsonify({"error": "User not found"}), 404

if __name__ == '__main__':
    app.run(debug=True)

Testing Path Parameters

Test your new path parameter endpoint with Postman:

Send a GET request to http://127.0.0.1:5000/users/1
You should receive user data for Alice:

Response (200 OK)

{
  "id": 1,
  "name": "Alice",
  "email": "alice@example.com"
}

Testing Query Parameters

Now test filtering with query parameters:

Send a GET request to http://127.0.0.1:5000/users?name=alice
You should receive filtered results:

Response (200 OK)

[
{
    "id": 1,
    "name": "Alice",
    "email": "alice@example.com"
}
]

Implementing API Security

Real-world APIs need protection. Let’s add API key authentication to secure your endpoints.

Step 2: Add API Key Authentication

Add this security layer to your app.py file:

# Add this constant at the top of your file
API_KEY = "mysecretapikey"

# Add this helper function
def check_api_key():
    key = request.headers.get("x-api-key")
    if key != API_KEY:
        return jsonify({"error": "Unauthorized - Invalid or missing API key"}), 403
    return None

# Modify your routes to check the API key
@app.route('/users', methods=['GET'])
def get_users():
    """
    Get all users or filter by name
    ---
    parameters:
      - name: name
        in: query
        type: string
        required: false
      - name: x-api-key
        in: header
        type: string
        required: true
        description: API key for authentication
    responses:
      200:
        description: A list of users
      403:
        description: Unauthorized - Invalid or missing API key
    """
    # Check API key first
    auth_error = check_api_key()
    if auth_error:
        return auth_error
        
    # Process the request if authenticated
    name_filter = request.args.get('name')
    if name_filter:
        filtered_users = [u for u in users if name_filter.lower() in u["name"].lower()]
        return jsonify(filtered_users)
    return jsonify(users)

Apply the same authentication check to your other endpoints for consistent security.

Testing Authentication

Test your API authentication in Postman:

Without API Key:
- Send a GET request to http://127.0.0.1:5000/users
- You should receive an unauthorized error:

Response (403 Forbidden)

{
  "error": "Unauthorized - Invalid or missing API key"
}

With Valid API Key:
- Add a header: x-api-key: mysecretapikey
- Send the same GET request
- You should receive the user data

Security Best Practices

In a real-world application, you would store API keys securely in a database and use environment variables rather than hardcoding them in your source code.

Professional API Documentation

Well-organized documentation is crucial for developers using your API. Let’s move the Swagger documentation to a separate file.

Step 3: Create Separate Swagger Documentation

Create a file named swagger.yaml with the following content:

openapi: 2.0.0
info:
  title: User Management API
  description: API for retrieving and managing user details
  version: 1.0.0
  contact:
    email: api@example.com
servers:
  - url: http://127.0.0.1:5000
securityDefinitions:
  ApiKeyAuth:
    type: apiKey
    in: header
    name: x-api-key
security:
  - ApiKeyAuth: []
paths:
  /users:
    get:
      summary: Get all users
      description: Returns a list of all users, optionally filtered by name
      parameters:
        - name: name
          in: query
          required: false
          type: string
          description: Filter users by name (case-insensitive)
      responses:
        "200":
          description: A list of users
          schema:
            type: array
            items:
              $ref: '#/definitions/User'
        "403":
          description: Unauthorized - Invalid or missing API key
  /users/{user_id}:
    get:
      summary: Get a user by ID
      description: Returns detailed information for a specific user
      parameters:
        - name: user_id
          in: path
          required: true
          type: integer
          description: The numeric ID of the user to retrieve
      responses:
        "200":
          description: User details
          schema:
            $ref: '#/definitions/User'
        "404":
          description: User not found
        "403":
          description: Unauthorized - Invalid or missing API key
definitions:
  User:
    type: object
    properties:
      id:
        type: integer
        description: Unique identifier for the user
      name:
        type: string
        description: User's full name
      email:
        type: string
        description: User's email address
    required:
      - id
      - name
      - email

Update your app.py file to load this YAML file:

from flasgger import Swagger
import yaml

app = Flask(__name__)

# Load Swagger documentation from file
with open("swagger.yaml", "r") as f:
    swagger_template = yaml.safe_load(f)
    
swagger = Swagger(app, template=swagger_template)

Now your API documentation is:

Separated from your code for better organization
Comprehensive with proper schemas and descriptions
Professional with proper OpenAPI formatting

When you visit http://127.0.0.1:5000/apidocs, you’ll see a professionally documented API with all your endpoints, authentication requirements, and response schemas.

Adding Error Handling and Validation

Robust APIs need proper error handling and data validation. Let’s add those features:

from flask import Flask, request, jsonify
from flasgger import Swagger
import yaml
import logging

# Configure logging
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s - %(name)s - %(levelname)s - %(message)s',
    filename='api.log'
)
logger = logging.getLogger(__name__)

app = Flask(__name__)

# Sample data
users = [
    {"id": 1, "name": "Alice", "email": "alice@example.com"},
    {"id": 2, "name": "Bob", "email": "bob@example.com"}
]

# API key for authentication
API_KEY = "mysecretapikey"

# Load Swagger documentation
with open("swagger.yaml", "r") as f:
    swagger_template = yaml.safe_load(f)
swagger = Swagger(app, template=swagger_template)

# Helper functions
def check_api_key():
    key = request.headers.get("x-api-key")
    if key != API_KEY:
        logger.warning(f"Unauthorized access attempt with key: {key}")
        return jsonify({"error": "Unauthorized - Invalid or missing API key"}), 403
    return None

def validate_user_data(data):
    errors = []
    if not data.get("name"):
        errors.append("Name is required")
    if not data.get("email"):
        errors.append("Email is required")
    elif "@" not in data.get("email", ""):
        errors.append("Invalid email format")
    return errors

@app.route('/users', methods=['GET'])
def get_users():
    # Log the request
    logger.info(f"GET request to /users with params: {request.args}")
    
    # Check API key
    auth_error = check_api_key()
    if auth_error:
        return auth_error
    
    # Process request
    name_filter = request.args.get('name')
    try:
        if name_filter:
            filtered_users = [u for u in users if name_filter.lower() in u["name"].lower()]
            return jsonify(filtered_users)
        return jsonify(users)
    except Exception as e:
        logger.error(f"Error processing request: {str(e)}")
        return jsonify({"error": "Internal server error"}), 500

@app.route('/users/<int:user_id>', methods=['GET'])
def get_user(user_id):
    # Log the request
    logger.info(f"GET request to /users/{user_id}")
    
    # Check API key
    auth_error = check_api_key()
    if auth_error:
        return auth_error
    
    # Process request
    try:
        user = next((u for u in users if u["id"] == user_id), None)
        if user:
            return jsonify(user)
        logger.info(f"User with ID {user_id} not found")
        return jsonify({"error": "User not found"}), 404
    except Exception as e:
        logger.error(f"Error processing request: {str(e)}")
        return jsonify({"error": "Internal server error"}), 500

@app.route('/users', methods=['POST'])
def add_user():
    # Log the request
    logger.info("POST request to /users")
    
    # Check API key
    auth_error = check_api_key()
    if auth_error:
        return auth_error
    
    # Process request
    try:
        data = request.get_json()
        if not data:
            return jsonify({"error": "Invalid JSON data"}), 400
            
        # Validate data
        validation_errors = validate_user_data(data)
        if validation_errors:
            return jsonify({"error": "Validation failed", "details": validation_errors}), 400
            
        # Generate new ID (in a real app, the database would handle this)
        new_id = max(user["id"] for user in users) + 1
        new_user = {
            "id": new_id,
            "name": data["name"],
            "email": data["email"]
        }
        users.append(new_user)
        
        logger.info(f"Created new user with ID {new_id}")
        return jsonify({"message": "User created", "user": new_user}), 201
    except Exception as e:
        logger.error(f"Error processing request: {str(e)}")
        return jsonify({"error": "Internal server error"}), 500

if __name__ == '__main__':
    app.run(debug=True)

Key Features of Your Intermediate API

Feature	Implementation	Benefit
Dynamic Parameters	Path variables and query parameters	Flexible data retrieval and filtering
Authentication	API key validation in request headers	Secure access to your API endpoints
Data Validation	Input checking before processing	Prevents bad data and improves reliability
Error Handling	Try/except blocks with proper status codes	Graceful failure and clear error messages
Logging	Request and error logging to file	Easier debugging and monitoring
Organized Documentation	Separate Swagger YAML file	Cleaner code and more maintainable docs

Testing Your Enhanced API

To properly test your enhanced API with Postman:

Test Authentication:
- Send requests with and without the x-api-key header
- Verify that unauthorized requests are rejected
Test Error Handling:
- Try accessing a non-existent user (e.g., /users/999)
- Send invalid data in POST requests
- Verify appropriate error messages and status codes
Test Dynamic Parameters:
- Use different query parameters (e.g., ?name=al to find “Alice”)
- Test path parameters with different IDs
Check Logging:
- Review your api.log file to ensure requests and errors are being recorded

Next Steps in API Development

Congratulations! Your API now has many of the features found in professional, production-grade APIs. Here are some advanced topics to explore next:

Database integration - Replace in-memory storage with a real database
Advanced authentication - Implement OAuth or JWT for more robust security
Rate limiting - Prevent abuse by limiting requests per client
Pagination - Handle large data sets efficiently
Caching - Improve performance for frequently accessed data
Automated testing - Create test suites for your API endpoints

Key Takeaways

Dynamic parameters make your API flexible enough to handle various client needs
Authentication is essential for securing your API from unauthorized access
Proper error handling and validation improve reliability and user experience
Logging helps with troubleshooting and monitoring API usage
Separating documentation from code makes both easier to maintain
Well-structured API responses improve the developer experience

What’s Next?

Ready to take your API skills to the expert level? In the next chapter, Expert API Development and Testing, you’ll learn advanced techniques for creating high-performance, scalable, and enterprise-grade APIs.

Intermediate API Development Resources

Further your API development skills with these resources.

External Resources

Tools & APIs

Start your learning journey!

Course Progress 0%

0 of 0 pages completed

Found value in the course?

Your support fuels my work!

Have an issue?

Help improve the course by reporting an issue